The QR Code "Mystery Package" Scam

The Problem: A package you never ordered shows up on your doorstep. Inside is a card with a QR code and a message like “Scan to find out who sent this gift” or “Register your item here.” Scanning it can take you to a fake site designed to steal your personal info or payment details, or quietly install something on your phone. This is a spin on the old “brushing” scam, where sellers ship cheap items to real addresses to fake positive reviews — now with a QR code hook added to phish you directly.

The Solution: Don’t scan QR codes from packages you didn’t order. If you get an unexpected delivery, check with everyone in the household first — sometimes it really is a gift. If it’s unsolicited and nobody claims it, you can typically just keep or toss it; you’re not obligated to pay for it or return it. Report it to the retailer it appears to be from (many have a page for this) and to the FTC at reportfraud.ftc.gov.

Reference: https://www.fcc.gov/how-identify-and-avoid-package-delivery-scams